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DETAILED ACTION 
Response to Amendment 

1. This is in response to request for reconsideration filed on January 21 , 2005. 
Original application contained Claims 1 - 45. Remarks filed on January 21, 2005 have 
been entered and made of record. Therefore, pending Claims 1 - 45 are presented for 
further consideration and examination. 

Claim Objections 

2. Claims 15 and16 are objected to because of the following informalities: Replace 
" ... at least one of the proxy server," with "...at least one of the proxy servers". 

Appropriate correction is required. 

Response to Arguments 

3. Applicant's arguments filed 7/20/2005 have been fully considered but they are 
not persuasive for the following reasons. 

Remarks contain errors with respect to "the features of a network acting on plural 
responses from protected servers and determining a preferred response to forward to 
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the service-requesting client were viewed as features not previously searched for" and 
also, with respect to patent numbers of the admitted prior art Cunningham et al. (U.S. 
Patent number should be 6,219,786). 

During the interview, Ronal Rudder (Registration number 45,618) and Dan 
Stephenson discribed the instant application, in detail and agreed that invention was not 
claimed properly as filed on 6/1 1/2001 and agreed to amend the claims to distinguish 
over the prior art. Examiner pointed out that there was no direct or explicit 
communication from acceptance monitor with the protected server(s) as Dan 
Stephenson claimed and suggested that "plural response from protected servers" 
(emphasis added) should be properly claimed. During the interview, neither claims nor 
admitted prior arts were discussed (see interview summary, 7/25/2005). 

4. Regarding independent Claim 1 and dependent claim 10 and 11, applicant 
argued that the cited prior art Cunningham et al. (U.S. Patent Number 6,219,786) do not 
disclose 11 scrutiny of the outgoing responses". This argument is not persuasive. 
Applicant agrees that Cunningham discloses rule base monitoring and controlling 
network access both inside and outside a network and also, scrutiny of the incoming 
requests (see Remarks page 13 lines 8-18). Cunningham discloses steps of 
monitoring network by applying set of rules to determine the best outgoing response 
(Cunningham Column 8 line 26 - Column 9 line 1 8 and Column 1 0 line 52 - Column 1 1 
line 48). 
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In response to applicant's argument that the references fail to show certain 
features of applicant's invention, it is noted that the features upon which applicant relies 
(i.e., " scrutiny of the outgoing responses" and "plural responses from protected servers 
and determining a preferred response to forward to the service-requesting client") and 
are not recited in the rejected claims 1,10 and 1 1 . Although the claims are interpreted 
in light of the specification, limitations from the specification are not read into the claims. 
See In re Van Geuns, 988 F.2d 1 181 , 26 USPQ2d 1057 (Fed. Cir. 1993). 

5. Therefore, the examiner respectfully asserts that the cited prior art does teach or 
suggest the subject matter "determine a preferred response from plural generated 
responses form a service requesting client", broadly recited in the amended 
independent claims 1,2, 18 and 1 9. The dependent claims 3-17 and 20 - 45 are 
rejected at least by virtue of their dependency on the dependent claims and by other 
reason set forth in this office action. 



Accordingly, the rejection for the pending claims 1 
maintained. 



- 45 is respectfully 
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Allowable Subject Matter 

6. Claims 8, 12-14 and 22 are objected to as being dependent upon a rejected 
base claim, but would be allowable if rewritten in independent form including all of the 
limitations of the base claim and any intervening claims. 

Claim Rejections - 35 USC § 103 

The text of those sections of Title 35, U.S. Code not included in this action can 
be found in a prior Office action. 

7. Claims 1 -7, 9- 11, 15-21 and 23 -45 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Cunningham et al. (U.S. Patent number 6,219,786, hereafter 
"Cunningham") in view of Reshef et al. (U.S. Patent Number 6,321 ,337). 

8. Regarding Claim 1 , Cunningham discloses and 

a proxy server configured to receive the incoming network service requests from 
the client and to forward said requests pursuant to a tolerance protocol to the protected 
servers (Cunningham Column 5 line 39 - Column 6 line 20); 

an acceptance monitor configured to receive from the protected servers one or 
more responses to the client request and applying one or more acceptance tests thereto 
(Cunningham Column 6 lines 1 - 25). 
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Cunningham discloses a third access (ballot) monitor for receiving the results 
from the acceptance monitors and validates the proxy server (firewall) along with 
acceptance monitors. Cunningham does not explicitly disclose that the third access 
monitor receiving from the acceptance monitor the results of the applied acceptance 
tests and determining a preferred response to the client request. However, Reshef 
discloses a security gateway (proxy) positioning between external environment and a 
trusted server that controls access through acceptance rules wherein the security 
gateway receives from the access monitor the results of the applied acceptance tests 
and determines a preferred response to the client request (Reshef Column 12 lines 19 - 
54). 



9. Motivation to combine the invention of Reshef with Cunningham comes from the 
need for providing a valid response by collecting responses from a variety of 
acceptance monitors and analyzing the response, Cunningham provide a discussion on 
the need for multiple acceptance rules but silent on ballot monitor, see Cunningham 
Column 6 lines 33 - 48. It would be obvious to one of ordinary skill in the art to combine 
Reshef with Cunningham because a consolidated response is needed for the results 
provided by the acceptance monitors of Cunningham and because Reshef provides 
some details of how a valid response is determined with access-rules, access lists and 
other relevant information. 
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10. Regarding Claim 2, Cunningham discloses and describes 

a proxy server configured to receive incoming network service requests from the 
client and to forward said requests pursuant to a tolerance protocol to the protected 
servers (Cunningham Column 5 line 39 - Column 6 line 20); 

an acceptance monitor configured to receive from the protected servers one or 
more of the plural responses and to apply one or more acceptance tests thereto 
(Cunningham Column 6 lines 1 -25); 

an intrusion sensor responsive to anomalies in operation of the network for and 
configured to detect threats to the network (Cunningham Column 6 lines 21 - 56 and 
Column 8 lines 10 - 48); and 

an adaptive reconfigurer configured to alter the tolerance protocol and to 
reconfigure a network forwarding scheme among the proxy server, acceptance monitor 
and the ballot monitor in response to a predetermined condition (Column 6 lines 1 - 48 
and Column 8 lines 26 - 53). 

Cunningham discloses a third access (ballot) monitor for receiving the results 
from the acceptance monitors and validates the proxy server (firewall) along with 
acceptance monitors. Cunningham does not explicitly disclose that the third access 
monitor receiving from the acceptance monitor the results of the applied acceptance 
tests and determining a preferred response to the client request. However, Reshef 
discloses a security gateway (proxy) positioning between external environment and a 
trusted server that controls access through acceptance rules wherein the security 
gateway receives from the access monitor the results of the applied acceptance tests 
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and determines a preferred response to the client request (Reshef Column 12 lines 19 - 
54). 



1 1 . Motivation to combine the invention of Reshef with Cunningham comes from the 
need for providing a valid response by collecting responses from a variety of 
acceptance monitors and analyzing the response, Cunningham provide a discussion on 
the need for multiple acceptance rules but silent on ballot monitor, see Cunningham 
Column 6 lines 33 - 48. It would be obvious to one of ordinary skill in the art to combine 
Reshef with Cunningham because a consolidated response is needed for the results 
provided by the acceptance monitors of Cunningham and because Reshef provides 
some details of how a valid response is determined with access-rules, access lists and 
other relevant information. 



12. Regarding Claim 18, Cunningham discloses and describes 

receiving the incoming network service request and forwarding the request 
pursuant to a tolerance protocol (Cunningham Column 7 lines 1 - 14); 

generating the plural response to the incoming network service request and 
forwarding the plural responses (Cunningham Column 7 lines 1 - 14); 

applying one or more acceptance tests to the response and forwarding 
acceptance test results (Cunningham Column 7 line 56 - Column 8 line 9). 

Cunningham discloses a third access (ballot) monitor for receiving the results 
from the acceptance monitors and validates the proxy server (firewall) along with 
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acceptance monitors. Cunningham does not explicitly discloses polling the test results 
to determine a preferred response based upon the poll. However, Reshef discloses a 
security gateway (proxy) positioning between external environment and a trusted server 
that controls access through acceptance rules wherein the security gateway receives 
from the access monitor the results of the applied acceptance tests and forwards a 
preferred response to the client request (Reshef Column 12 lines 19 - 54). 

13. Motivation to combine the invention of Reshef with Cunningham comes from the 
need for providing a valid response by collecting responses from a variety of 
acceptance monitors and analyzing the response, Cunningham provide a discussion on 
the need for multiple acceptance rules but silent on ballot monitor, see Cunningham 
Column 6 lines 33 - 48. It would be obvious to one of ordinary skill in the art to combine 
Reshef with Cunningham because a consolidated response is needed for the results 
provided by the acceptance monitors of Cunningham and because Reshef provides 
some details of how a valid response is determined with access-rules, access lists and 
other relevant information. 

14. Regarding Claim 19, Cunningham discloses and describes 

receiving the incoming network service request and forwarding the request 
pursuant to a tolerance protocol (Cunningham Column 7 lines 1 - 14); 

generating the plural responses to the incoming network service request and 
forwarding the plural response (Cunningham Column 7 lines 1 - 55); 
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applying one or more acceptance tests to the plural responses and forwarding 
acceptance test results; 

detecting any anomalies in operation of the network (Cunningham Column 8 
lines 34 - 53); and 

revising the tolerance protocol and a network forwarding scheme in response to 
an anomaly in operation of the network (Cunningham Column 8 line 54 - Column 9 line 
13). 

Cunningham discloses a third access (polling) monitor for receiving the results 
from the acceptance monitors and validates the proxy server (firewall) along with 
acceptance monitors. Cunningham does not explicitly disclose that the third access 
monitor receiving from the acceptance monitor the results of the applied acceptance 
tests and determining a preferred response to the client request. However, Reshef 
discloses a security gateway (proxy) positioning between external environment and a 
trusted server that controls access through acceptance rules wherein the security 
gateway receives from the access monitor the results of the applied acceptance tests 
and determines a preferred response to the client request (Reshef Column 12 lines 19 - 
54). 

15. Motivation to combine the invention of Reshef with Cunningham comes from the 
need for providing a valid response by collecting responses from a variety of 
acceptance monitors and analyzing the response, Cunningham provide a discussion on 
the need for multiple acceptance rules but silent on ballot monitor, see Cunningham 
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Column 6 lines 33 - 48. It would be obvious to one of ordinary skill in the art to combine 
Reshef with Cunningham because a consolidated response is needed for the results 
provided by the acceptance monitors of Cunningham and because Reshef provides 
some details of how a valid response is determined with access-rules, access lists and 
other relevant information. 

16. Claim 3 is rejected as applied above in rejecting claim 1 . Furthermore, 
Cunningham and Reshef disclose and describe wherein said proxy server further is 
configured to forward said incoming network service request to an acceptance monitor 
and a ballot monitor (Cunningham Column 7 lines 1-14 and Reshef Column 12 lines 
19-54) . 

17. Claim 4 is rejected as applied above in rejecting claim 1 . Furthermore, 
Cunningham and Reshef disclose and describe wherein said proxy server comprises 
multiple independent proxy servers (Cunningham Column 6 lines 1 - 32; Column 8 lines 
26 - 53 and Reshef Column 7 lines 10 - 28). 

18. Claim 5 is rejected as applied above in rejecting claim 1. Furthermore, 
Cunningham discloses and describes, wherein said acceptance monitor comprises 
multiple independent acceptance monitors (Cunningham Column 6 lines 1 - 32 and 
Column 8 lines 26 - 53). 
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19. Claim 6 is rejected as applied above in rejecting claim 1 . Furthermore, 
Cunningham and Reshef disclose and describe, wherein said ballot monitor comprises 
multiple independent ballot monitors (Reshef Column 7 lines 10 - 28). 

20. Claim 9 is rejected as applied above in rejecting claim 1 . Furthermore, 
Cunningham and Reshef discloses and describes, wherein said proxy server is 
configured to forward said incoming network service request to the at least one of the 
protected servers, the acceptance monitor and the ballot monitor (Cunningham Column 
6 lines 1 - 32; Column 8 lines 26 - 53 and Reshef Column 7 lines 10 - 28). 

. 21. Claim 10 is rejected as applied above in rejecting claim 1. Furthermore, 
Cunningham discloses and describes, wherein said acceptance monitor is configured to 
apply one or more acceptance tests taken from the group of satisfaction of requirements 
test, accounting test, reasonableness test or computer run time test (Cunningham 
Column 8 26 - Column 9 line 18). 

22. Claim 11 is rejected as applied above in rejecting claim 1. Furthermore, Reshef 
discloses and describes, wherein said ballot monitor is configured to determine the 
preferred response using a process taken from the group of: simple majority voting, 
Byzantine agreement process, or adjudication process (Reshef Column 7 lines 10 - 28). 
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23. Claim 7 is rejected as applied above in rejecting claim 2. Furthermore, 
Cunningham discloses and describes wherein said intrusion sensor comprises a 
multiplicity of sensors configured to monitor predetermined operations of the network 
(Cunningham Column 6 lines 1 - 32; Column 8 lines 26 - 53). 

24. Claim 15 is rejected as applied above in rejecting claim 2. Furthermore, 
Cunningham and Reshef discloses and describes, wherein at least one of the proxy 
server, the acceptance monitor, the ballot monitor, the intrusion sensor, and the 
adaptive reconfigurer comprises a separate and independent processor (Cunningham 
Column 6 lines 1 - 32; Column 8 lines 26 - 53 and Reshef Column 7 lines 1 0 - 28 and 
Column 8 lines 1 5 - 45). 

25. Claim 16 is rejected as applied above in rejecting claim 2. Furthermore, 
Cunningham and Reshef discloses and describes, wherein two or more of the proxy 
server, acceptance monitor, ballot monitor, intrusion sensor and adaptive reconfigurer 
operate on a single processor (Cunningham Column 6 lines 1 - 32; Column 8 lines 26 - 
53 and Reshef Column 7 lines 1 0 - 28 and Column 8 lines 1 5 - 45). 

26. Claim 17 is rejected as applied above in rejecting claim 2. Furthermore, 
Cunningham and Reshef disclose and describe, wherein the adaptive reconfigurer is 
configured to reconfigure the network forwarding scheme to establish multiple 
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independent network forwarding paths (Cunningham Column 6 lines 1 - 32; Column 8 
lines 26 - 53 and Reshef Column 7 lines 1 0 - 28 and Column 8 lines 1 5 - 45). 

27. Claim 20 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes, wherein the receiving the incoming network 
service request further comprises: 

receiving the incoming network service request at a proxy server (Cunningham 
Column 7 lines 1 - 14). 

28. Claim 21 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein forwarding the incoming network service 
request to the at least one protected servers (Cunningham Column 5 lines - 51; and 
Column 10 lines 21 -51). 

29. Claim 23 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein the receiving the incoming network 
service request further comprises forwarding the request on multiple independent paths 
(Column 6 lines 1 - 32 and Column 8 line 26 - Column 9 line 48). 

30. Claim 24 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein of generating the plural responses 
comprises: 



Application/Control Number: 09/878,824 
Art Unit: 2136 



Page 15 



generating the plural responses at any of the protected servers (Column 6 lines 1 

-32). 

31. Claim 25 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein the forwarding the plural responses 
comprises: 

forwarding the plural responses to an acceptance monitor (Column 6 lines 1-32; 
Column 7 lines 15-25 and Column 8 lines 26 - 53). 

32. Claim 26 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein the forwarding the plural responses 
comprises: 

forwarding the plural responses to multiple acceptance monitors (Column 6 lines 
1 - 32 and Column 8 lines 26 - 53). 

33. Claims 27 and 32 are rejected as applied above in rejecting claim 18. 
Furthermore, Cunningham discloses and describes the forwarding the plural responses 
comprises: 

forwarding the plural responses on multiple independent paths (Column 6 lines 1 
- 32 and Column 8 line 26 - Column 9 line 48). 
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34. Claim 28 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein the applying one or more acceptance 
tests comprise applying one or more acceptance tests at an acceptance monitor 
(Column 8 line 26 - Column 9 line 18). 

35. Claim 29 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein the applying one or more 
acceptance tests comprise applying independent acceptance tests to each of the plural 
response (Column 8 line 26 - Column 9 line 18). 

36. Claim 30 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein the forwarding the acceptance test 
results comprises: 

forwarding the acceptance test results to a ballot monitor (Column 6 lines 1 - 32; 
Column 8 lines 26 - 53 and Reshef Column 7 lines 10 - 28). 

37. Claim 31 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein the forwarding the acceptance test 
results comprises: 

forwarding the tests results to multiple ballot monitors (Column 6 lines 1 - 32; 
Column 8 lines 26 - 53 and Reshef Column 7 lines 10 - 28). 
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38. Claim 33 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein the polling the acceptance test results 
comprises polling the acceptance test results at a ballot monitor (Column 6 lines 1-32 
and Column 7 line 56 - Column 8 line 53). 

39. Claim 34 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein the polling the acceptance test results 
comprises applying multiple polling routines (Column 6 lines 1 - 32 and Column 7 line 
56 - Column 8 line 53 and Reshef Column 7 lines 1 0 - 28). 

40. Claim 35 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes wherein the polling the acceptance test results 
comprises applying multiple polling routines to responses from each of a multiplicity of 
ballot monitors (Column 6 lines 1 - 32 and Column 7 line 56 - Column 8 line 53 and 
Reshef Column 7 lines 10 - 28). 

41. Claim 36 is rejected as applied above in rejecting claim 18. Furthermore, 
Cunningham discloses and describes a method for reconfiguring communication among 
network components to minimize the impact of intrusive events (Fig. 1, 2, 6 7; Summary 
and Column 5 line 8 - Column 1 1 line 50), wherein at least one of receiving an incoming 
network service request, generating the plural responses, applying one or more 
acceptance tests, polling the acceptance test results and forwarding the preferred 
response comprises: utilizing a separate processor to enhance independence of 
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operation and minimize the impact of the intrusive event (Column 7 line 56 - Column 8 
line 53). 

42. Claim 37 is rejected as applied above in rejecting claim 19. Furthermore, 
Cunningham discloses and describes wherein the revising the tolerance protocol and 
network forwarding scheme further comprises: 

forwarding the plural responses on multiple independent paths (Column 6 lines 1 
- 32 and Column 8 line 26 - Column 9 line 48). 

43. Claim 38 is rejected as applied above in rejecting claim 19. Furthermore, 
Cunningham discloses and describes wherein the revising the tolerance protocol and 
network forwarding scheme comprises forwarding the plural responses to multiple 
independent acceptance monitors (Column 6 lines 1 - 32 and Column 8 lines 26 - 53). 

44. Claim 39 is rejected as applied above in rejecting claim 19. Furthermore, 
Cunningham discloses and describes wherein the step of revising the tolerance protocol 
and network forwarding scheme comprises: 

forwarding results of applied acceptance tests to multiple independent ballot 
monitors (Column 6 lines 1 - 32 and Column 8 lines 26 - 53 and Reshef Column 7 lines 
10-28). 
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45. Claim 40 is rejected as applied above in rejecting claim 19. Furthermore, 
Cunningham discloses and describes wherein the revising the tolerance protocol and 
network forwarding scheme comprises: 

forwarding to multiple independent proxy servers (Column 6 lines 1 - 32 and 
Column 8 lines 26 - 53). 

46. Claim 41 is rejected as applied above in rejecting claim 19. Furthermore, 
Cunningham discloses and describes wherein the revising the tolerance protocol and 
network forwarding scheme further comprises: 

comparing any detected anomalies with known anomalies to identify a 
predetermined intrusion tolerance protocol (Column 6 lines 1 - 32 and Column 8 lines 
26 - 53). 

47. Claim 42 is rejected as applied above in rejecting claim 19. Furthermore, 
Cunningham discloses and describes wherein the revising the tolerance protocol and 
network forwarding scheme comprises: 

determining an acceptance monitor that will be used to support the selected 
tolerance protocol (Column 8 line 54 - Column 9 line 48). 

48. Claim 43 is rejected as applied above in rejecting claim 19. Furthermore, 
Cunningham discloses and describes wherein the revising the tolerance protocol and 
network forwarding scheme comprises: 
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determining a ballot monitors that will be used to support the selected tolerance 
protocol (Column 8 line 54 - Column 9 line 48). 

49. Claim 44 is rejected as applied above in rejecting claim 19. Furthermore, 
Cunningham discloses and describes wherein the revising the tolerance protocol and 
network forwarding scheme comprises: 

determining a proxy server that will be used to implement a selected tolerance 
protocol (Column 8 line 54 - Column 9 line 48). 

50. Claim 45 is rejected as applied above in rejecting claim 19. Furthermore, 
Cunningham discloses and wherein the revising the tolerance protocol and network 
forwarding scheme comprises: 

prioritizing multiple incoming network service requests (Column 8 line 54- 
Column 9 line 48 and Column 10 line 32 - Column 1 1 line 46). 

Conclusion 

51. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
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TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

52. Examiner's Note: Examiner has cited particular columns and line numbers in the 
references as applied to the claims above for the convenience of the applicant. 
Although the specified citations are representative of the teachings in the art and are 
applied to the specific limitations within the individual claim, other passages and figures 
may apply as well. It is respectfully requested from the applicant, in preparing the 
responses, to fully consider the references in entirety as potentially teaching all or part 
of the claimed invention, as well as the context of the passage as taught by the prior art 
or disclosed by the examiner. 

53. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. See PTO Form 892. 

Applicant is urged to consider the references. However, the references should be 
evaluated by what they suggest to one versed in the art, rather than by their specific 
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disclosure. If applicants are aware of any better prior art than those are cited, they are 
required to bring the prior art to the attention of the examiner. 

54. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Pramila Parthasarathy whose telephone number is 571- 
272-3866. The examiner can normally be reached on 8:00a.m. To 5:00p.m.. If attempts 
to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Ayaz 
Sheikh can be reached on 571-232-3795. Any inquiry of a general nature or relating to 
the status of this application or proceeding should be directed to the receptionist whose 
telephone number is 703-305-3900. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR only. For more 
information about the PAIR system, contact the Electronic Business Center (EBC) at 
866-217-9197 (toll-free). 

Pramila Parthasarathy a a c 



September 27, 2005. 



/Ayaz sheikh 

SUPERVISORY PATENT EXAMINER 
TECHNOLOGY C£*tTER 2100 




